Privacy Policy

Last updated: July 3, 2026

1. Introduction

ContractShield ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered contract review platform ("Service"). By using the Service, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Name and email address
  • Password (stored as a salted, one-way hash — we never store or see your plain-text password)
  • Department and role within your organization
  • Company name and profile information

2.2 Contract Documents

When you upload contracts for review, we collect and process:

  • The uploaded document files (PDF, DOCX, TXT)
  • Extracted text content from those documents
  • Metadata you provide (contract title, counterparty, type, value, dates)
  • AI analysis results (clause assessments, risk scores, suggested changes)

2.3 Usage Data

We automatically collect:

  • Log data (IP address, browser type, access times, pages visited)
  • Feature usage patterns (which tools you use, how often)
  • Error logs and performance metrics

2.4 Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers, CVVs, or full payment details on our servers. We store only a Stripe customer ID to link your account to your billing information.

3. How We Use Your Information

We use collected information to:

  • Provide the Service: Process contracts, run AI analyses, generate redlines and reports
  • Improve the Service: Analyze usage patterns to enhance features and fix issues
  • Communicate: Send notifications about contract reviews, due dates, and account activity
  • Secure the Service: Detect and prevent fraud, abuse, and security threats
  • Billing: Process payments, manage subscriptions, and send invoices
  • Support: Respond to your questions and provide technical assistance

4. AI Processing

4.1. When you run an AI review, your contract text is sent to our AI processing partner (Anthropic) for analysis. This processing is governed by our data processing agreement with Anthropic.

4.2. Your contract content is not used to train AI models. It is processed solely to generate your analysis results and is not retained by the AI provider after processing.

4.3. AI-generated analysis results are stored in our database and associated with your account for your ongoing use.

5. Data Storage and Security

5.1. Your data is stored on secure servers with encryption at rest and in transit (TLS/SSL).

5.2. We implement industry-standard security measures including:

  • Bcrypt password hashing with salt (12 rounds)
  • JWT-based authentication with short-lived access tokens
  • Role-based access control on all API endpoints
  • Rate limiting to prevent abuse
  • Complete audit trail of all user actions
  • File upload validation and size limits

5.3. Despite our efforts, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Sharing

We do not sell your personal information. We may share data with:

  • AI Processing: Anthropic (for contract analysis) — under data processing agreement
  • Payment Processing: Stripe (for billing) — see Stripe's Privacy Policy
  • Legal Requirements: When required by law, court order, or governmental authority
  • Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice to you)

7. Data Retention

7.1. Active accounts: We retain your data for as long as your account is active.

7.2. Terminated accounts: We retain your data for 30 days after account termination to allow for data export. After 30 days, your data is permanently deleted.

7.3. Audit logs: Retained for 7 years for compliance purposes.

7.4. You may request data export or deletion at any time by contacting support.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate personal data
  • Deletion: Request deletion of your personal data
  • Portability: Request your data in a machine-readable format
  • Objection: Object to certain processing of your personal data
  • Restriction: Request restriction of processing in certain circumstances

To exercise any of these rights, contact us at [email protected].

9. Cookies & Local Storage

We use minimal browser storage for essential functionality:

  • Authentication tokens: Stored in your browser's local storage (not cookies) to maintain your session
  • Preferences: Your UI preferences (sidebar state, etc.), also in local storage
  • Cookie banner choice: Remembers whether you've acknowledged our storage notice

We do not use third-party tracking cookies or advertising cookies.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. Your continued use after changes take effect constitutes acceptance.

13. Contact Us

For questions or concerns about this Privacy Policy or our data practices:

ContractShield
Email: [email protected]
Support: [email protected]